EU AI Act: what actually changes for organisations using AI at work
Europe's AI regulation is now fully in force. Here is what it means in practice for organisations that use ChatGPT, Claude, Copilot or similar systems every day.
For years we talked about the EU AI Act as a law that was coming.
It has arrived.
The regulation entered into force in August 2024. The provisions covering high-risk AI systems and general-purpose AI apply from August 2026.
Many organisations now find themselves in an uncomfortable position:
they use AI every day, but have not yet worked out what that means from a regulatory standpoint.
It is not only a problem for companies that "build AI"
The first misunderstanding to clear up is about who the law covers.
The EU AI Act does not apply only to companies that develop models.
It also applies to organisations that use AI systems in the course of their activities.
In the regulation's terminology, those organisations are called deployers: entities that put an AI system into use in a professional context.
This includes:
- a law firm that uses an AI assistant to analyse contracts;
- a healthcare organisation that uses an LLM to process clinical notes;
- an HR department that uses AI to evaluate job applications;
- a technical team that uses an AI assistant to write or review code;
- any organisation that has built workflows around models such as GPT-4, Claude or Gemini.
If your organisation fits any of these descriptions, the EU AI Act applies to you.
What high-risk systems are
The regulation distinguishes between levels of risk.
High-risk systems are those capable of having a significant impact on fundamental rights, health, safety or access to essential services.
Annex III of the regulation lists the categories:
- systems used in education or vocational training to evaluate people;
- systems used for recruitment and selection of employees;
- systems used for the delivery of essential public benefits;
- systems used in the administration of justice;
- systems used in healthcare and medical devices;
- biometric systems;
- critical infrastructure systems.
For these systems the obligations are substantial: risk management, technical documentation, logging, human oversight, pre-deployment testing.
But there is one aspect that affects almost every organisation, regardless of the risk level of the system they use.
The issue that touches everyone: GPAI and data handling
The language models that power ChatGPT, Claude, Copilot and similar products fall into the category of general-purpose AI systems — known as GPAI.
For GPAI with systemic impact (the largest and most widely deployed models), the regulation places specific obligations on providers: documentation of the training process, data governance policies, cybersecurity measures, declaration of conformity.
This applies primarily to those who develop the models.
But it creates an important downstream effect for those who use them.
When your organisation sends data to a GPAI system, two parallel obligations arise automatically:
under the AI Act — using the system in a compliant manner, maintaining adequate oversight, documenting use in high-risk contexts;
under the GDPR — if that data contains personal information, all the rules on processing, legal bases, data subject rights and security measures apply.
The problem is not theoretical.
Every time an employee pastes a contract, a clinical note, a CV or a support ticket into an AI system, both obligations may be triggered simultaneously.
Where the AI Act and GDPR overlap
The relationship between the AI Act and the GDPR is one of the most practically relevant issues for organisations.
The GDPR applies every time personal data is processed.
The AI Act applies every time an AI system is used.
When AI systems are used to process personal data — which is exactly what happens in most enterprise use cases — both apply.
Some concrete implications:
Impact assessments. If the AI system is high-risk and processes personal data, both an AI Act conformity assessment and a GDPR Data Protection Impact Assessment may be required.
Legal bases. Sending personal data to an external AI system requires a valid legal basis. A provider declaring that they do not use data for training is not sufficient by itself.
Right to explanation. The AI Act introduces a right to receive explanations about automated decision-making in certain contexts; the GDPR contains a parallel right for significant automated decisions.
Data retention. Logs generated by AI systems fall under GDPR. How long are they retained? Who can access them? In which country are they processed?
The wrong answer: ban everything
Faced with this regulatory landscape, a understandable reaction is a blanket prohibition.
Some organisations have blocked access to ChatGPT or similar tools.
The problem is that this strategy is hard to sustain.
People find ways to use the tools that make them productive.
And without an official channel, they do so through unmanaged channels, with less oversight and less visibility for the organisation.
Banning AI does not solve the problem. It simply makes it invisible.
The right answer: move control upstream
There is a principle that security-aware system designers know well:
it is more effective to reduce the attack surface than to guard every point of access.
Applied to data handling in AI, this means:
reducing the amount of personal data that enters the system, before the system processes it.
Instead of:
Document with PII → LLM
you build:
Document with PII → detection → pseudonymisation → LLM
The practical result is significant.
The model receives the context it needs to do its job.
The actual identifying data never leaves the controlled perimeter.
Regulatory exposure is reduced: less personal data processed by the AI system means fewer obligations to manage on the GPAI side.
GDPR compliance becomes simpler: the system handles pseudonyms, not real identities.
A question many organisations have not yet asked seriously
The AI Act is in force.
Penalties for the most serious violations can reach 3% of total global annual turnover for deployers.
But the issue is not only about penalties.
It is about a question that many organisations have not yet asked with sufficient seriousness:
What data are we sending to the AI systems we use every day?
This is not a technical question.
It is a governance question.
And the answer cannot be "we do not know".
Where Pseudora fits
Pseudora was built precisely to address this question.
Not as a compliance tool for its own sake.
But as a technical layer that reduces the amount of personal data flowing through AI systems.
Pseudora can be integrated:
- as a proxy in API calls to external LLMs;
- in RAG pipelines before embedding and indexing;
- in document processing workflows before content reaches an AI assistant;
- in internal tools that use LLMs for analysis, summarisation or classification.
The principle is always the same:
the model receives the context.
The identity stays separate.
The regulatory exposure is reduced.
The EU AI Act does not ask organisations to stop using AI.
It asks them to use it in a deliberate, documented and proportionate way.
Reducing personal data before it enters the system is the most concrete starting point.
Regulatory notes
- Regulation (EU) 2024/1689 of the European Parliament and of the Council, published in the Official Journal of the European Union on 12 July 2024.
- Entry into force: 1 August 2024.
- Application of provisions on prohibited practices: February 2025.
- Application of GPAI provisions: August 2025.
- Full application including high-risk systems: August 2026.
- Regulation (EU) 2016/679 (GDPR), applicable in parallel for all processing of personal data.